EXPOSING ADFECTION: HOW DISCOVER-TECH TURNED TARGETED ADS INTO A PIPELINE FOR ZERO-CLICK MERCENARY SPYWARE

Summary from the TLDR InfoSec newsletter

Citizen Lab links Israeli ad company Discover-Tech to zero-click delivery of Candiru spyware through targeted advertisements. Its Controlium platform lets customers select targets by mobile ad ID, cookie ID, or IP address, then run JavaScript when an ad is rendered. At least 45 Al Jazeera devices were infected in 2024 and 2025. Nearly four billion bidding records show ads across almost 200,000 sites and apps. Google, IAB Europe, Beeswax, Vungle, and Eskimi cut Discover-Tech's access after disclosure. A separate actor, DARK CARTOGRAPHER, used the infrastructure to link advertising IDs with phone numbers.